3 ms·

I think this is a bit of an unfair, perhaps even elitist post, and certainly seems a bit against the culture here at HN. Why so much text devoted to tearing do

I think this is a bit of an unfair, perhaps even elitist post, and certainly seems a bit against the culture here at HN. Why so much text devoted to tearing down without a single suggestion as to how they could do better, or where their flaws are now? Is it that you can't give $1000/hr advice for free, but instead have to defend the value of that $1000/hr? I am most definitely not a security expert, but this sure seems like a step forward, and has some really interesting aspects to it from a Bitcoin perspective. (that they can deposit to the offline storage without actually touching the offline storage is one) Yes, the most glaring issue is there is only one offline storage site. But if the person with the decryption key is different than the person with the safe deposit key (and I suppose more than one of each) then I don't see the glaring issue. Please offer constructive criticism instead of just tearing it down.

ghshephard 14y ago
These people are proposing to manage people's money, without having a serious understanding of how to secure it. For me, it's akin to watching someone build a bridge that people's cars are going to be driving across without having a background in civil engineering. I may not be able to tell them how to build the bridge, but I sure know it's going to end poorly when they try to do it themselves. As a first step, add an NofM authentication process with a pair of sophos/utimaco HSMs doing rate/key/encryption management.
- nicpottier 14y ago
  Thanks, that is nice to actually have a suggestion. One note is that I think you vastly overestimate the competency level of organizations. Just because they are large and have an air of security does not mean their systems are terribly secure. I can speak from personal experience that huge government organizations that ought to know better have absolutely glaring security holes. But yes, we should all strive to do better. I think NofM encryption in particular would be a great improvement.
davidw 14y ago
> I think this is a bit of an unfair, perhaps even elitist post, and certainly seems a bit against the culture here at HN. Maybe it's just my impression, but a lot of security-related discussions evoke the "comic book guy voice". Speaking of... any of you security guys want to recommend a good book that talks about different solutions and common situations when they're useful? Not a "how to...", but a "know that this thing is available, and here's when it might be useful".

ghshephard 14y ago

These people are proposing to manage people's money, without having a serious understanding of how to secure it. For me, it's akin to watching someone build a bridge that people's cars are going to be driving across without having a background in civil engineering. I may not be able to tell them how to build the bridge, but I sure know it's going to end poorly when they try to do it themselves. As a first step, add an NofM authentication process with a pair of sophos/utimaco HSMs doing rate/key/encryption management.

nicpottier 14y ago
Thanks, that is nice to actually have a suggestion. One note is that I think you vastly overestimate the competency level of organizations. Just because they are large and have an air of security does not mean their systems are terribly secure. I can speak from personal experience that huge government organizations that ought to know better have absolutely glaring security holes. But yes, we should all strive to do better. I think NofM encryption in particular would be a great improvement.

davidw 14y ago

> I think this is a bit of an unfair, perhaps even elitist post, and certainly seems a bit against the culture here at HN. Maybe it's just my impression, but a lot of security-related discussions evoke the "comic book guy voice". Speaking of... any of you security guys want to recommend a good book that talks about different solutions and common situations when they're useful? Not a "how to...", but a "know that this thing is available, and here's when it might be useful".